An Oracle Java audit letter rarely looks like an audit. It arrives as a friendly "Java SE review" email from your account manager, asking you to confirm your usage. What happens in the first few days — before you reply, before you run a single script — determines whether this becomes a routine conversation or a seven-figure back-licence claim. Here are the first seven steps to protect your position.
If you have received an Oracle Java audit letter, do not reply immediately. Confirm whether it is an informal "soft audit" or a formal LMS audit, route all contact through one person, request written clarification and an NDA, never run Oracle's discovery scripts blindly, build your own baseline first, and get independent buyer-side advice before your first call.
Almost no Oracle Java audit begins with the word "audit." The first contact is usually an email from your existing Oracle account manager, written in deliberately casual language: "We're conducting a routine Java SE review and would appreciate confirmation of your current usage," or "Oracle is reaching out to customers about Java SE licensing changes — can we schedule a quick call?" Sometimes it arrives from a "Java licensing specialist" or Oracle's GLAS (Global Licensing and Advisory Services) team. The tone is helpful, not adversarial. That is by design.
This is what the industry calls a "soft audit" — a commercial review that has all the data-gathering objectives of a formal audit but none of the contractual formality. Oracle's agenda is consistent: convert your organization onto the Java SE Universal subscription, which is priced on your total employee headcount rather than actual Java use. Under that metric, every employee counts, whether or not they ever touch Java. For background on how that pricing model works and why it is so costly, see our Oracle Java licensing guide.
A smaller share of letters are formal LMS (License Management Services) audit notices, issued under the audit clause of your Oracle license agreement. These reference your contract, set a defined response window and carry genuine contractual weight. The first thing to establish, before anything else, is which of the two you are holding — because your obligations and your leverage differ completely. The broader mechanics of both routes are covered in our Oracle audit guide.
The instinct after receiving an Oracle letter is to respond quickly and helpfully — to demonstrate good faith. That instinct works against you. Oracle's Java review process is engineered so that the customer's first reply is also their most damaging. A same-day answer signals you have no internal process, no independent advisor and no idea what your real exposure is. It invites Oracle to set the pace.
Nothing in a soft-audit email requires an instant answer. Even a formal LMS notice gives you a response window measured in weeks, not hours, and that window is usually negotiable. The few days after the letter arrives are the most valuable in the entire process: they are the only time you control the timeline, before Oracle has anchored a number or pulled you into a cadence of calls. Use them to prepare, not to react.
The single most expensive mistake: forwarding Oracle's questionnaire to your infrastructure team and asking them to "just fill it in." Engineers report every Java install they can find — including free OpenJDK builds Oracle has no right to charge for. That self-reported number becomes Oracle's opening claim, and it cannot be un-sent.
Before you reply to Oracle, talk to our Oracle Java audit defense team. We report a 100% Java audit defense record — no client has paid a Java audit claim unless they chose to. Get a confidential assessment first.
The following seven steps are the sequence we walk clients through in the first week after an Oracle Java audit letter lands. Follow them in order — each one preserves leverage for the next.
None of these steps are confrontational. They are simply the difference between responding on Oracle's terms and responding on yours. Our Oracle Java audit defense service exists to run this exact sequence on your behalf, from the first letter to final resolution.
No — and the distinction is the most consequential thing to establish in step two. A formal LMS audit is an exercise of the audit rights written into your Oracle license agreement. It obliges you to cooperate reasonably within a defined window, but those same contractual terms also limit Oracle: it can only audit compliance with the specific products and metrics in your agreement, not conduct an open-ended inspection of your infrastructure.
A Java SE "review" or soft audit, by contrast, is a commercial conversation initiated by your account team. You have no contractual obligation to run their scripts, share inventory or even take the call. Customers routinely hand Oracle data in a soft audit that Oracle could never have compelled in a formal one — because the friendly framing makes it feel like cooperation rather than disclosure. Understanding which process you are in tells you exactly how much you are obligated to give and how much leverage you hold.
According to Oracle Licensing Experts (2026), the Java SE Universal Employee metric can cost an enterprise five to ten times more than the equivalent Named User Plus (NUP) deployment it replaced — which is precisely why Oracle works so hard to move customers onto it, and why the first response to a Java letter carries such weight. With 25+ years of combined Oracle licensing experience and a 100% Java audit defense record, our team has seen every variant of this opening move.
Not without independent review — and never as your first action. Oracle's Java discovery scripts and self-assessment questionnaires are presented as a neutral measurement, but in practice they are calibrated to maximise the licensable count. They scan for Java binaries across servers and desktops and, critically, they frequently fail to distinguish Oracle JDK from the many free and third-party distributions that Oracle has no right to charge for.
In the inventories we review, a large share of "Oracle Java" installations turn out to be OpenJDK, Amazon Corretto, Azul Zulu, Eclipse Temurin or Red Hat builds — none of which require an Oracle subscription. Others are runtimes embedded inside third-party ISV applications, licensed by the vendor, not by you. A script run by your own team, or worse, by Oracle, sweeps all of these into one number. That number becomes Oracle's opening claim, and because you reported it, it is far harder to walk back.
The correct order is the reverse of what Oracle proposes: build your own forensic baseline first, classify every installation by distribution and entitlement, exclude what is not yours, and only then decide what, if anything, to share. This is the heart of buyer-side Oracle Java licensing advisory — controlling the evidence before Oracle does.
Read how we reduced a $15M telecom Java audit claim to zero by classifying the estate before Oracle could. The first move — refusing to run Oracle's scripts blindly — set up the entire defense.
Oracle's Java audit process is built around time pressure. Soft-audit emails often include an artificial deadline — "we'd like your response by the end of the month" — that carries no contractual force whatsoever. Formal LMS notices set a genuine window, typically 30 to 45 days, but even that is usually negotiable when you ask professionally and in writing. In both cases, the clock is a lever, and Oracle controls it only if you let it.
The dynamic to understand is that every day of urgency favors Oracle's number. A rushed response means an incomplete baseline, an over-reported inventory and a customer negotiating from a position of fear. A measured response — acknowledging the letter, clarifying scope, building your own evidence — flips that pressure back. The reason step one is "do not reply immediately" is that the first reply is where most of the timeline leverage is won or lost.
Used well, the first week buys you the months you need. By confirming scope, requesting an NDA and presenting your own classified inventory, you reset the conversation onto a timeline that serves your preparation rather than Oracle's quota. From there, the historical claim becomes contestable and the forward subscription becomes negotiable — which is exactly where you want to be before the first real number is ever discussed.
The complete enterprise playbook for responding to an Oracle Java audit letter — soft-audit tactics, scope control, distribution differentiation and the full defense framework, from independent former Oracle insiders.
Download Free →It is an email or formal notice from Oracle's account team, LMS or GLAS group asking you to confirm or review your Java SE usage. Most begin as an informal "Java review" or soft audit rather than a formal contractual audit, but both are designed to lead toward a Java SE Universal subscription priced on your total employee count.
Not immediately, and not on Oracle's terms. If the contact is an informal account-team review, you are not contractually obligated to participate at all. If it is a formal LMS audit under your contract's audit clause, you must cooperate reasonably — but you still control timing, scope and how data is presented. Always confirm which type it is before responding.
No — not without independent review. Oracle's Java discovery scripts and self-assessment questionnaires routinely over-report by counting free OpenJDK builds, third-party distributions and embedded ISV runtimes as licensable Oracle JDK. Once that data is submitted, it cannot be withdrawn and becomes the basis for Oracle's claim.
Informal review emails set artificial deadlines that carry no contractual weight. Formal LMS audits give a defined response window, typically 30 to 45 days, that is usually negotiable. The timeline favors Oracle, so the right first move is to slow the process down enough to prepare a defensible position.
No. A Java SE review or soft audit is a commercial conversation initiated by your account team, not an exercise of Oracle's contractual audit rights. A formal audit is triggered under the audit clause of your license agreement. The difference determines what you are obligated to provide and how much leverage you hold.
Yes. Engaging an independent, buyer-side Oracle Java licensing advisor before your first substantive call lets you control scope, present a defensible inventory and avoid the over-reporting that drives inflated claims. Oracle Licensing Experts reports a 100% Java audit defense record — no client has paid a Java audit claim unless they chose to.
Weekly intelligence on Oracle Java SE licensing changes, audit trends, and defense strategies — from former Oracle insiders now working exclusively for enterprise buyers.
Oracle Licensing Experts Team — Former Oracle executives, LMS auditors, and Java licensing specialists now working exclusively for enterprise buyers. Independent and 100% buyer-side — we are never affiliated with Oracle Corporation. About us →
Just got an Oracle Java audit letter? Our Oracle Java audit defense service works exclusively for the buyer. Request a confidential briefing →